ATM Skimming Fraud: How Scammers Try to Steal Your Money

Over the years ATM cards have evolved to become a staple and, for many, a necessity in modern society. These digital cards offer an incredible convenience to consumers as a way to have quick access to banking at any given hour or day. No longer are individuals confined to what was traditionally known as "banker's hours." Thanks to ATMs, people can access their bank accounts, make transfers or withdraw money at any time of the day they want.

What is Skimming?

Anything of tangible value that increases convenience typically comes with at least a couple of drawbacks. Like many other technologies, ATM cards are no exception. Unfortunately, ATM fraud is running rampant and a process called "skimming" is not only on the rise, but becoming more sophisticated in nature and getting harder to detect.

Statistics suggest more than $2 billion in losses at ATMs occur globally and this number is rising; skimming represents about a third of all fraud. For ATMs, it is the number one problem.

ATM card skimming occurs when a thief attaches an external device to an ATM machine in order to capture any information stored on the bank card of an account holder. The information is then stolen and used for illicit purposes, mainly theft. These frauds used to be fairly easy to detect, but have gotten very sophisticated in nature. Other ways thieves compromise ATMs is through injecting malware. With everything running on software, it makes ATMs very appealing opportunities to hackers.

Credit: Sean MacEntee via Flickr/CC by 2.0 with Attribution

How Do Skimmers Work?

How it works is the physical skimmer, which is a magnetic head, is attached to the ATM machine and positioned on top of the card insert; the skimming device is usually designed to look authentic. Once the user inserts their bank card, the fraudulent device then intercepts the data stored on the ATM card; at this time the user will often see some sort of error message. In addition, thieves also use small pin-sized cameras which can read PIN numbers punched into the ATM keypad, and sometimes mirrors are used to help capture information.

In the past, the skimming equipment was clunky and easier to detect, but as technology progresses, the card-readers are now more sophisticated and harder to differentiate from authentic ATM card-readers. Some are "razor thin" as Gizmodo reports in August 2014 showing photos of how these devices have evolved (courtesy Brian Krebs). 8

Combine these authentic looking devices with Bluetooth technology and stealing data is quick and easy for the scammers. Scammers also are getting savvy in the way they are installing the skimmers on Saturdays and removing them before the bank reopens Monday morning. By the time people notice something amiss when information is updated, the stolen data has already long been transferred to another country (Wall Street Journal). 1

Credit: Aaron Poffenberger on Flickr/CC by 2.0 with Attribution

From the photos description on Flickr written by photographer, "This card skimmer is designed to adhere to the front of the ATM machine and skim the user's ATM debit card as it passes through to the real ATM card reader. In the picture you can see a bit of the material they used to stick the reader to the ATM. It feels like a light-duty caulk. It doesn't have much sticking power. The device came off with just the slightest tug. Notice that it's shaped just like the face of the card reader on the ATM machine."

An Evolving Type of Fraud

Skimming is not a new technique, but with the precise and improved progression of technology, thieves are exploiting technology in order to design clever ways to, well, rob a bank. Additionally, the days of a one-man thieving operation are over, today's ATM fraudsters have evolved into huge operations which are run by organized gangs.

In 2010, Avivah Litan, a fraud analyst at research firm Gartner estimated "fraud involving debit cards, PINs and point-of-sale equipment has surged 400 percent over the past five years." One tactic, she said, has been "flash attacks". Using the stolen information, gangs create thousands of counterfeit debit cards and then dispatch cronies to at least 100 ATM machines in several cities at once. Each withdraws a small dollar amount from several accounts to avoid fraud-detection software, adding up to tens of thousands of dollars in losses, reported the Wall Street Journal. (courtesy Yahoo!) 1

In years past, many of the ATM scams were executed at independent ATM kiosks or at retail points of sale, however more thieves are currently going right to the bank and using these ATM machines as a target. In 2009, an increased trend of targeted bank-owned ATM machines was observed. Also in 2009 the "U.S. Secret Service estimated ATM skimming theft was about $1 billion a year, or $350,000 a day," reported ABC News. 2 This is not small potatoes.

More recently, scammers are getting even more bold, even creating total fake ATMs and fitting them over the legitimate machine, as evidenced by an incident in Sweden that occurred in late 2013.

Vigilance is Needed These Days

The facts that the thieves are targeting banks is a huge concern. Individuals tend to feel more comfortable and secure when they go directly to the bank rather than use a third party ATM machine. Not to mention successful skims at banks can significantly increase theft statistics as banks typically see over 1,500 transactions per day, whereas independent machines see perhaps 200 or less.

Credit: Leigh Goessl

A street-side ATM located at a bank in Washington D.C.

If statistics on ATM skimming continue to rise, coupled with the more difficulty in detecting tampered machines, this is likely eventually going to lead to a requirement of better use of security technology on the banks and retailers end. It will become too costly not to invest in stronger technologies. Currently, banks have already been challenged after Microsoft decided to pull the plug for support of its Windows XP operation system in April 2014. The majority of banks in both the United States and globally use ATMs that run off XP, so this presents a large dilemma for banks. Although, some experts note it "goes deeper" than that and thieves are bypassing operating systems completely. 5

In order to protect themselves, consumers are smart to educate themselves on what to look for in order to avoid becoming a victim of ATM skimming fraud. Always use machines in well-lit areas, cover your PIN when typing it in (in case any hidden cameras are present) and familiarize yourself with the machines you use most and, if possible, try to stick to those - you're better apt to notice something different (although this isn't a guarantee, but it does help protect against the less-savvy skimmers).

Education, coupled with preventative practices, can help consumers protect their bank information and the funds in their accounts. And perhaps even that is no guarantee. It is also important to carefully track transactions. This way, if an account is compromised, it can be caught quickly and financial loss/damage limited.

The Future of ATM Cards

In the United States during 2015, big changes took place. The new EMV credit cards were rolled out by many big-name companies with merchants and vendors expected to follow shortly due to a stipulation that will put the latter responsible for financial damage if they do not upgrade their equipment, rather than than creditors. ATM and debit cards have a little more time, they have until 2017. Although, will this stop the fraud?

“Crooks always find another way to get you,” ATMIA U.S. Executive Director David Tente said in a July 2015 interview with American Banker. “It never goes away. It just changes what it looks like.” 10

Either way new protective measures or not, ATM fraud continues to be on the rise and this is a problem that is not going to go away soon, if ever. Along with experts, the history of fraud suggests it won't either, tech-savvy thieves always seem to stay one or many steps ahead.

The New York City Police Department shares more information about ATM skimmers and some additional tips of what to do and what else to look for when using these machines.

Reply to this Comment

Reply to this Comment

I've been hearing more and more stories about these kind of fraudulent activity. There were some episodes of one of my favorite shows that touched on the subject; American Greed. Thanks for sharing the intel and the article.
Keep up the awesome work.

Reply to this Comment

Reply to this Comment

I tend to use the same machines - limit them to two local ones so I'm familiar with how they look and if out of the area try to find ones inside of the bank. We've had some incidents in nearby towns closer to Washington DC, but also read there is an uptick on these scams happening in small towns too. Thanks for reading and commenting!

Reply to this Comment

Reply to this Comment

Reply to this Comment

I had my card skimmed and the thieves were so clever only ever taking small amounts at a time. As a result it took me two months to actually work out what was going on, which was only because the transaction were charged in my home suburb while I was at work in another suburb. Also they would try a small $2 transactions to make sure they hadn't been detected before making larger withdrawals

Reply to this Comment

So sorry to hear this has happened to you. From what I've read many thieves are doing exactly that to avoid detection as a "test". Doing it locally I imagine the bank didn't see things were amiss. Thanks for commenting.